2013 IEEE Security and Privacy Workshops
StegTorrent: a Steganographic Method for the P2P File Sharing Service
Paweł Kopiczko, Wojciech Mazurczyk, Krzysztof Szczypiorski Warsaw University of Technology, Institute of Telecommunications Warsaw, Poland e-mail: [email protected], {wm, ksz}@tele.pw.edu.pl
Abstract—The paper proposes StegTorrent a new network and so on, or the whole service, for example, VoIP (Voice steganographic method for the popular P2P file transfer over IP) [11]. service—BitTorrent. It is based on modifying the order of data One of the most important aspects for every packets in the peer-peer data exchange protocol. Unlike other steganographic method is the choice of the proper carrier for existing steganographic methods that modify the packets’ the secret data. The most favorable carrier for secret order it does not require any synchronization. Experimental messages must have two features: results acquired from prototype implementation proved that it It should be popular, that is, usage of such a carrier provides high steganographic bandwidth of up to 270 b/s while should not be considered as an anomaly itself. The more introducing little transmission distortion and providing such carriers are present and utilized in networks the difficult detectability. better it is, because they mask the existence of hidden Keywords: network steganography, BitTorrent, information communication. hiding, P2P Modification of the carrier related to the embedding of the steganogram should not be “visible” to the third party unaware of the steganographic procedure. Contrary to I. INTRODUCTION typical steganographic methods, which utilize digital BitTorrent [1], [2], a file-transfer system originally media (pictures, audio and video files) as a cover for released in July 2001, is currently the most popular P2P hidden data (steganogram), network steganography (Peer-to-Peer) networking system worldwide [3] that allows utilizes communication protocol control elements and users to share particular resources in the form of files. their basic intrinsic functionality. As a result, such Studies show that the number of users exceeded 100 million methods may be harder to detect and eliminate. in 2011, and that BitTorrent traffic accounts for about 94% of all P2P traffic, and is responsible for about 22% of North Thus, because of its popularity and traffic volume, American fixed access daily traffic [4], which is BitTorrent’s traffic is an ideal candidate for the hidden data continuously increasing each year. The success of BitTorrent carrier. In this paper, we present detailed analysis of primarily comes from two factors: its efficiency and potential opportunities for information hiding in BitTorrent. openness. BitTorrent is significantly more efficient than Each network steganography method can be classical client/server-based architectures. It allows peers characterized by three features. First, steganographic sharing the same resource to form a P2P network, and then it bandwidth that describes how much secret data one is able to focuses on fast and efficient replication to distribute the send using a particular method per time unit. Second, resource. It is also worth noting that because in BitTorrent a undetectability, defined as an inability to detect a resource is divided into many fragments, a single peer is able steganogram inside certain carriers. The most popular way to to download many fragments simultaneously and it does not detect a steganogram is to analyze the statistical properties need the whole resource to share it. Additionally, BitTorrent of the captured data and compare them to the typical software is free to download and many clients’ versions are properties of that carrier. The last feature is the open source. This leads to the easy deployment of new steganographic cost, which describes the degree of applications and technologies, therefore stimulating further degradation of the carrier caused by the steganogram improvements. insertion procedure. The steganographic cost depends on the Steganography encompasses all concealing techniques type of carrier, and, if it becomes excessive, it leads to easier that embed a secret message into the carrier of this message detection of the steganographic method. For example, if the in such a way that the carrier modification caused by the method uses voice packets as a hidden data carrier for embedding of the steganogram must not be “noticeable” to steganographic purposes in IP telephony, then the anyone. It is important to emphasize that, for a third party steganographic cost is expressed in conversation observer who is not aware of the steganographic procedure, degradation. If the hidden data carrier is a certain field of the the exchange of steganograms remains hidden. Currently, protocol header, then the cost is expressed as a potential loss one of the most dynamically evolving steganography in that protocol functionality, and so forth. subdisciplines is network steganography [10]. To perform For each network steganography method, a trade-off is hidden communication, it utilizes network protocols and/or always necessary between maximizing steganographic relationships between them as the secret data carriers. Many bandwidth and still remaining undetected (and retaining an methods were proposed and were aimed at specific network acceptable level of the steganographic cost). A user can protocols from TCP/IP stack, for example, IP, TCP, UDP,
© 2013, Pawel Kopiczko. Under license to IEEE. 151 DOI 10.1109/SPW.2013.11 utilize a method naively and send as much secret data as to initiate the connection with a swarm. After the connection possible, but it simultaneously raises the risk of disclosure. is established, popular BitTorrent extensions like PEX (Peer Therefore, he/she must purposely resign from some fraction Exchange) [2] or DHT (Distributed Hash Table) [4] are of the steganographic bandwidth in order to be undetectable. used. These extensions enable communication between We wish to also emphasize that network steganography peers without using a tracker as part of the swarm. can be utilized by decent users to exchange covert data, for In a BitTorrent specification, peer-peer data exchange example, to circumvent censorship, to provide a should be conducted using an application layer—a communication channel between journalists and their proprietary TCP-based protocol. It is a stateful protocol that information sources or by companies that are afraid of is used to establish connections similar to the TCP corporate espionage, but it can also be used by intruders to handshake mechanism. However, it is also possible that leak confidential data or to perform network attacks. This is instead of using TCP protocols in a transport layer, UDP- the usual trade-off that requires consideration in a broader based μTP (µTorrent Transport Protocol) [15] should be information hiding context, which is beyond the scope of used. This UDP-based protocol was introduced in 2009. It is this paper. not part of the original BitTorrent specification, but it was The rest of this paper is structured as follows. Section II created by BitTorrent Inc., and as the results of a previous introduces the basics of the BitTorrent P2P system. Section study indicated [14], it is currently the most popular choice. III presents the current state of research efforts on The main aim of the μTP protocol is to efficiently steganography in P2P networks and in BitTorrent in manage usage of the available bandwidth during file particular. Section IV describes the proposed steganographic transfers, while limiting the impact of file transfers on the method: StegTorrent, while in Section V the obtained on-going transmissions (especially non-BitTorrent related experimental results are presented. Finally, Section VI ones). The μTP protocol is capable of automatically concludes our work. reducing the rate at which BitTorrent packets are transmitted between peers in case there is interference with other II. BITTORRENT BASICS applications running on the same host. This protocol uses a BitTorrent is a P2P file sharing system that allows its congestion control algorithm, which is a modified version of users to distribute large amounts of data (especially large LEDBAT (Low Extra Delay Background Transport) [5], files) over IP networks. BitTorrent is distinguished from based on one-way delay measurements. The μTP protocol other similar file-transfer applications in that instead of was implemented in the very popular BitTorrent client, downloading a resource (one or more files) from a single μTorrent (http://www.utorrent.com) beginning with version source (e.g. a central server), users download fragmented 2.0, and it is currently used by default. This protocol is also files from other users at the same time. As a result, the file- used in other BitTorrent clients, such as in BitTorrent transfer time is considerably decreased because the group of (http://www.bittorrent.com), Vuze (http://www.vuze.com), users that share the same resource (or part of it) may consist or Transmission (http://www.transmissionbt.com). of several to thousands of hosts. Such a group of users The μTP header format is illustrated in Fig. 1 and the interested in the same resource (known as “peers”) combine field roles are explained below. together with a central component (known as a “tracker”) in BitTorrent. This combination of peers and trackers is called 4 4 8 32 a “swarm”. Trackers are responsible for controlling the ver type extension connection_id resource transfer between the peers. Peers that hold onto a timestamp_microseconds particular resource or part of a resource are required to share timestamp_difference_microseconds the resource and to perform the transfer. We can distinguish two types of BitTorrent peers based wnd_size on the stage at which they are involved in downloading or seq_nr ack_nr sharing a given resource. These types are: Seeds—peers that possess the complete resource and are Figure 1. μTP header format. only sharing it. The fields are utilized as follows [15]: Leechers—peers that do not possess the complete Ver—version of the protocol. Currently version 1 is used. resource but they are interested in doing so. They also share the fragments they have already downloaded. Type—packet type. Currently four types are defined: When a leecher obtains all the remaining fragments of ST_DATA = 0—data packet, ST_FIN = 1— packet that the resource it automatically becomes a seed. ends the connection, ST_STATE = 2—acknowledgment packet (ack_nr field), without any other data, In BitTorrent specification ([1], [2]), two main protocols ST_RESET = 3—packet that forces the end of the are described that regulate data transfer: peer-tracker and connection, ST_SYN = 4—initializes the connection. peer-peer. Extension—type of the first extension on the extension The connection between peer and tracker can be list. Currently two types are specified: Selective acks and established with the use of an HTTP (Hypertext Transfer Extension. More about these extensions can be found in Protocol), or through UDP-based requests. Currently, the [15]. role of the tracker is diminished. The tracker is used mostly
152 Connection_id—random, unique number that is a III. RELATED WORK connection identifier. Steganography in P2P networks has been previously Timestamp_microseconds—Number of microseconds targeted by the research community. Information hiding from the last full second that passed from the time the techniques were utilized there to: last packet was sent from the local machine. Create a steganographic storage service—Mnemosyne Timestamp_difference_microseconds—the difference [8]—that applies steganography from a local storage between the local time and the timestamp in the last system [9] to a distributed, peer-to-peer system that is received packet, at the time the last packet was received. based on distributed hash tables, This is the latest one-way delay measurement of the link Build an adaptive covert communication system [12]. from the remote peer to the local machine. Wnd_size—Advertised receive window (in bytes). However, none of the abovementioned works proposed Seq_nr—the sequence number of this packet. steganographic methods that utilize P2P-system-specific Ack_nr—the sequence number the sender of the packet protocols—they reused well-known existing ones. last received from the remote peer. To the authors’ best knowledge, only two papers discussed BitTorrent-specific steganographic methods. In From the abovementioned header fields, the 2008 Li et al. [6] proposed to utilize torrent meta files to Timestamp_microseconds would play an important role for hide information. Two approaches were specified there: one the proposed steganographic method. was based on changing the case of the letters in the URL Typically, the BitTorrent client establishes many addresses and the other reused some of the torrent file fields. connections with other peers during the whole transmission Both these approaches are now obsolete since URLs are now process—typically about 70 [14]. BitTorrent connections are being replaced by Magnet-URIs (http://magnet- characterized by the high packet rate and a single resource is uri.sourceforge.net). downloaded by a number of clients simultaneously (one-to- Eidenbenz et al. [7] introduced an interesting concept for many transmission). This is also exemplarily illustrated in hidden communication in P2P networks and for BitTorrent Figure 2 where it may be observed that the order in which in particular. The key idea is to allow conspiring peers to packets to different clients are generated is highly variable find one another without being revealed by means of the so and that the packets for different network localizations are called steganographic handshake and broadcast. heavily interleaved with each other. The authors propose enabling hidden communication to 9 x 10 vary the fragment request sequence (request order channel). 3.5 Few other methods are sketched there as alternatives for the above mentioned that is based on: 3 Selection of a subset of fragments to be requested according to a shared secret—this is an enhancement of the method described above. 2.5 Applying variations in the timing of the P2P protocol messages or the rate at which resource fragments are 2 sent. For protocol messages it can be achieved, for example, by embedding secret data into the time between IPaddress the reception of a fragment request and the 1.5 corresponding transmission. For resource fragments (or rather packets), the rate at which they are sent is 1 modified to enable hidden communication. For these methods, the authors conclude that they are feasible if the connection between the peers is stable and that, in 0.5 0 2 4 6 8 10 real-life networks, usage of the correction codes is Timestamp [s] necessary. This is in fact a known problem for Figure 2. High variability in order in which packets to different clients steganographic methods that utilize time relations [13] as are generated well as requiring synchronization and achieving generally lower steganographic bandwidth than other That is why, due to its variability and high volume, the methods. order in which the packets are sent or received by the client Setting the port number that contains hidden can be utilized as a carrier for hidden data exchange. This information—as the authors indicate themselves, this feature is used by StegTorrent to enable clandestine method is of limited use as a port number does not communication for the BitTorrent service. change during connection, thus only its initial value can be utilized. This results in very low steganographic bandwidth.
153 Unfortunately, it must also be emphasized that for the and the other direction is analogous. No knowledge of the methods described above the authors did not provide any network’s topology is necessary. The hidden data sender experimental results, thus they were not properly evaluated. uses the modified BitTorrent client—StegTorrent client—to However, they have proved feasible in the publicly available share a resource that is downloaded by the second implementation BitThief (http://bitthief.ethz.ch). StegTorrent client that consists of a group of controlled BitTorrent clients. In this paper, we propose a new steganographic method for BitTorrent—StegTorrent. The proposed method relies on the modification of the order of the data packets in the peer- peer data exchange protocol. The reordering of the packets is not new in the context of network steganography and it is a part of the broader group of methods that modify time relations between PDUs (Protocol Data Units) [10]. PDUs can be affected by modifying their inter-packet delay or introducing intentional losses or reordering. The first proposed utilization of the reordering for network protocol was by Kundur and Ahsan [18]. To be able to control packet sorting, they proposed using sequence number fields from Figure 3. StegTorrent hidden data exchange scenario. the IPSec protocol headers: ESP (Encapsulating Security Payload) and AH (Authentication Header). Also Chakinala For the sake of the proposed method’s description and et al. [17] studied and formalized various models for hidden analysis, we define the term data package as a set of IP communication in ordered channels and presented addresses that is sent within the IP packets in a simulation results for TCP traffic. However, all of these predetermined order and the term data package size as the methods were lacking in undetectability or steganographic total number of elements in this set. For example, let us bandwidth. In real-life IP networks, the reordering in unicast assume that the data package size is 2. In this case, two transmissions (as the authors assume) is not witnessed often. packets with two different IP addresses (e.g. IP1 and IP2) Thus, when intentional reordering is exploited excessively it are used to send bits of hidden data. In this simple scenario, would be easy to discover, and when it is limited then the if the order of the packets is modified for steganographic resulting steganographic bandwidth is low (typically a few purposes, the BitTorrent client receives a packet that was bits per second or less). Moreover, such a solution typically sent from IP1 and then from IP2, then it will be interpreted requires a synchronization mechanism to correctly extract as binary “0”, in other case binary “1”. We assume that the secret data. data package and its size are a shared secret between Another concept was proposed by Luo et al. [19]. To transmitting and receiving StegTorrent clients. send hidden data authors control the order in which It must be noted that this method’s performance depends segments are distributed along simultaneous TCP on the size of the data package while the latter relies on the connections. If the segments reach the receiver in the number of available receiving IP addresses (receiving intended order they are mapped onto the hidden data bits BitTorrent clients under control). sequence. However, for this solution authors did not A. Sender side explained how they deal with the effects of delays and losses in real-life IP networks that can interference with the As mentioned above, the secret data bits are encoded in steganogram extraction. In this case some kind of the order in which the data packets are sent to the particular transmitter-receiver synchronization would be necessary. set of receiving clients. For example, if the secret data Presented in this paper StegTorrent takes advantage of the receiver controls two clients, A and B, then if the specific facts that in BitTorrent there are usually one-to-many packet reaches A first and then B, then it would mean transmissions and that the μTP header provides a means for sending binary “0”; in the other case it will be interpreted as packet numbering and retrieval of their original sequence. binary “1”. To encode hidden data bits, Lehmer code is This allows the provision of quite a high steganographic utilized [16] (the encoding is known a priori to the secret bandwidth (hundreds of bits per second) under the terms of data sender and receiver). Then for n different numbers of IP undetectability with no requirements on synchronization. addresses we are able to encode ⌊log2(n!)⌋ bits per data package. For example, for four packets with different IP IV. STEGTORRENT DESCRIPTION addresses in a data package we are able to send 4 bits. The clandestine communication scenario we consider for However, if the StegTorrent sender relies only on the proposed method is illustrated in Figure 3. We assume modifying the order of the data packets in which they were that both the secret data sending and receiving sides are in generated by the transmitter, then, due to poor network control of a certain number of BitTorrent clients and, as conditions, the order of the packet could be changed. This mentioned above, their IP addresses are known to each could potentially lead to problems with successful other. In Figure 3, for the sake of clarity, only single steganogram extraction. The solution is to incorporate into direction steganographic transmission is presented, but of StegTorrent the intentional modification of the course, end-to-end bidirectional communication is possible timestamp_microseconds field from the μTP protocol (see
154 Section II). Values from these fields allow the unambiguous recognition of the order in which the packets were originally transmitted in the typical BitTorrent client. By intentionally modulating these values while generating packets to enforce certain sequences, the sender can ensure that, even if the order of the transmitted packets is disrupted, the receiver would be able to correctly extract Figure 4. StegTorrent hidden data exchange scenario bits of the steganogram. First, we analyzed the number of packets that were sent B. Receiver side from different IP addresses during each session. The The secret data receiver gathers all the information from information obtained can then be utilized to pinpoint the best the BitTorrent clients under the control of StegTorrent number of IP addresses that can be used to create a package during the resource download session. Then it orders the and to achieve the highest steganographic bandwidth under packets’ IP addresses based on their the terms of the method’s undetectability. timestamp_microseconds values and begins the extraction of The obtained results are presented in Figure 5. Only the secret data bits. ten most active IP addresses are presented separately and the To understand how the StegTorrent receiver works, the rest are aggregated. Each session is described as xTy where x following example is presented below. Let us assume that denotes the number of downloaded resources and y is the the data package size is 5 and we denote packets sent to the number of the session. As expected, the results vary greatly, five IP addresses: 1 when the packet is sent to IP1, 2 when which is beneficial from the undetectability point of view. the packet is sent to IP2 and so on. Let us further assume That is why, in Figure 6, we also present the most different that by X we will be denoting packets sent to IP addresses cases as well as the average. outside the data package. If the exemplary packets’ stream is:
1, 4, 4, X, X, 4, 4, 3, X, 3, 3, 5, 2, 2, 5, 5, 2, 2, 2, 4, 4, 4, X, 5, … then, because the even number of packets from the same number are omitted and X are not taken into account, the receiver will extract the following secret bits colored with yellow:
1, 4, 4, X, X, 4, 4, 3, X, 3, 3, 5, 2, 2, 5, 5, 2, 2, 2, 4, 4, 4, X, | 5 …
The resulting data package is {1, 3, 5, 2, 4}. Then this package is mapped to certain predefined secret data bit sequences. The last packet from IP5 (marked with grey) is the beginning of the new data package since the size of the data package is 5. If some packets are lost then the secret data receiver will wait for retransmission which is ensured by the μTP protocol. The retransmitted packet will have the same timestamp_microseconds value as the original one. After the packet is retransmitted and the received data is complete, the secret data receiver is ready to extract the secret data. Figure 5. Distribution of number of packets sent from different IP addresses during single resource downloading session (in %); xTy – x V. EXPERIMENTAL RESULTS denotes number of downloaded resources and y is the number of the To experimentally evaluate the proposed steganographic session. method, the StegTorrent prototype implementation was developed and the test-bed was setup (Fig. 4). The presented It turned out that in every session there was at least one scenario is a simpler version of that presented in Figure 3; IP address that was dominant and responsible for sending, in however, the main principles and functioning of the most cases, more than 25% of the total number of packets proposed method remain the same. In this test-bed, twenty (the result falls in the 16–77% range). It is also worth noting sessions of resource downloading were performed and the that, in most cases, more than 75% of all packets are sent by average results are presented. For each session 500 000 µTP six different IP addresses and that this is why this number packets and the corresponding logs were captured and was selected as the maximum size of the analyzed package subjected to analysis. in the following measurements.
155 TABLE I. EXPERIMENTAL RESULTS FOR SINGLE RESOURCE DOWNLOADING SCENARIO
Standard Packets Case Data Steganographic deviation utililzation # package bandwidth [b/s] size [b/s] [%] A 2 438.41 106.43 65.05 A 3 467.28 120.51 51.69 A 4 590.49 162.88 43.36 Figure 6. Examples of distribution of number of packets sent from A 5 607.73 176.89 37.07 different IP addresses during a single resource downloading session (in %) – (a) balanced (1T3), (b) single IP address dominant (1T20), (c) average. A 6 656.01 200.88 31.93 B 2 82.82 54.87 11.50 Next, we analyzed the achieved StegTorrent B 3 66.29 38.33 6.95 steganographic bandwidth as well as the utilization of B 4 67.99 52.16 4.24 packets in the created covert channel that is defined as the ratio between the number of packets used for the creation of B 5 63.99 46.10 2.99 data packages (thus sending secret data) and number of all B 6 74.30 51.25 2.51 packets received during the session. The measurements were C 2 273.00 93.27 40.49 conducted for three cases, where: C 3 239.02 91.96 26.17 All of the IP addresses are utilized for data package C 4 227.95 106.01 16.46 creation (Case A), C 5 138.59 96.52 8.10 The number of IP addresses equals the size of the C 6 74.30 51.25 2.51 package (Case B), The number of IP addresses used for data package creation is 6 (Case C). Finally, Figure 7 illustrates packet utilization for different data packages sizes for Case C and sessions 1T3, Case A is the least practical due to the requirement to 1T20 and the average (from Fig. 6). It proves that packet control the endpoints with all IP addresses that took part in utilization in StegTorrent is related to the distribution of the resource downloading—Cases B and C are definitely more number of packets sent from different IP addresses, but not realistic. Moreover, for B and C only, the most active IP as much as could be expected. In other words even if there is addresses were utilized, that is those that sent the largest a dominant IP address (like in Fig. 6, b) packet utilization number of packets during the downloading session. In each does not decrease considerably when compared to the case, the five different sizes of data packages were analyzed average results (about 7%) and the difference is smaller for from 2 to 6. The following figures and tables present the larger data package sizes (2–5%). Also, as mentioned before, average results. packet utilization decreases with the increase in data Table I presents the obtained experimental results for package size. single resource downloading sessions for cases A–C. Obviously, the best results were achieved for Case A where
1T3 all IP addresses were used for package creation. However, as 45 1T20 mentioned before, in practice, this is the most difficult 1T Average scenario to accomplish. Steganographic bandwidth for this 40 case is in the range 430–660 b/s and it increases with the 35 increase in package size. On the other hand, packet utilization with small package sizes is more than 50% while, 30 with the package size increase, it falls to about 30%. 25 The experimental results obtained for Case C were significantly better than for Case B for small package sizes. 20 It is worth noting that the steganographic bandwidth for
Packets utilization [%] utilization Packets 15 Case B and a package size of 6 is more than three times lower than for Case C and package size 2, while the latter is 10 easier to implement. This is caused by the usually not well 5 balanced distribution of packets from different IP addresses 0 (Fig. 6, c). That is why, when the larger data package size is 2 3 4 5 6 utilized, a considerable number of packets from IP addresses Package size that are chosen for steganographic purposes are not carrying any secret data (they are not included in packages). This in Figure 1. Packet utilization for different data packages sizes (case C). turn results in very low packet utilization for larger data package sizes (<10% for sizes equal to 5 or 6).
156 The StegTorrent steganographic cost is negligible, since [7] R. Eidenbenz, T. Locher, R. Wattenhofer, “Hidden Communication it only introduces a small delay in resource downloading by in P2P Networks Steganographic Handshake and Broadcast,” Proc. re-sorting the packets in the predefined order. This is of IEEE INFOCOM 2011, April 2011, pp. 954–962. [8] S. Hand, T. Roscoe, “Mnemosyne: Peer-to-Peer Steganographic completely transparent to the BitTorrent client. Storage”, Proc. of IPTPS 2002, LNCS 2429, pp. 130–140, 2002. VI. CONCLUSIONS [9] R. Anderson, R. Needham, A. Shamir. “The Steganographic File System,” Proc. of International Workshop on Information Hiding, This paper presents a new BitTorrent-specific method 1998. called StegTorrent that relies on the modification of the [10] W. Mazurczyk, M. Smolarczyk, K. Szczypiorski, “Retransmission order of data packets in the peer-peer data exchange Steganography and Its Detection,” Soft Computing, Vol. 15, Issue 3, protocol. StegTorrent takes advantage of the facts that in pp. 505–515, 2011. BitTorrent there are usually many-to-one transmissions and [11] W. Mazurczyk, “VoIP Steganography and Its Detection - A Survey,” In: Computing Research Repository (CoRR), abs/1203.4374, that the μTP header provides a means of packet numbering arXiv.org E-print Archive, Cornell University, Ithaca, NY (USA), and retrieval of their original sequence. This allows the March 2012. provision of quite a high steganographic bandwidth, of about [12] F.V. Yarochkin, Shih-Yao Dai, Chih-Hung Lin, Yennun Huang, Sy- 270 b/s, for the most realistic scenario under the terms of Yen Kuo, “Introducing P2P Architecture in Adaptive Covert undetectability and with no requirement for synchronization. Communication System,” Proc. of Asian Himalayas International Conference on Internet (AH-ICI 2009), 2009, pp. 1–7. ACKNOWLEDGMENT [13] S. Cabuk, C.E. Brodley, C. Shields, “IP Covert Timing Channels: Design and Detection,” Proc of. 11th ACM Conference on Computer This research was partially supported by the Polish Ministry and Communications Security (CCS 2004), New York, 2004, pp. of Science and Higher Education and the Polish National 178–187. Science Center under grants: 0349/IP2/2011/71 and [14] W. Mazurczyk, P. Kopiczko, “What More Can Be Learnt About 2011/01/D/ST7/05054. BitTorrent From Meta-data Files and uTorrent Logs?,” In Computing Research Repository (CoRR), abs/1110.6265, arXiv.org E-print REFERENCES Archive, Cornell University, Ithaca, NY (USA), October 2011. [15] A. Norberg, “μTorrent Transport Protocol,” URL: [1] B. Cohen, “The BitTorrent Protocol Specification”, URL: http://bittorrent.org/beps/bep_0029.html, 2009. http://www.bittorrent.org/beps/bep_0003.html, 2008. [16] D. H. Lehmer, “Teaching Combinatorial Tricks to a Computer,” [2] BitTorrent Protocol Specification v1.0, URL: http://wiki.theory.org/BitTorrentSpecification, 2006. Proc. Sympos. Appl. Math. Combinatorial Analysis, Amer. Math. Soc., vol. 10, 1960, pp. 179–193. [3] M. Hartley, “BitTorrent Turns Ten”, Financial Post, July 2011, URL: [17] R. C. Chakinala, A. Kumarasubramanian, R. Manokaran, G. Noubir, http://business.financialpost.com/2011/07/01/bittorrent-turns-ten/ U. Rangan, R. Sundaram, “Steganographic Communication in [4] A. Loewenstern, DHT Protocol, URL: Ordered Channels ,” Proc. of Information Hiding (IH2006), LNCS, http://bittorrent.org/beps/bep_0005.html, 2008. 2006. [5] S. Shalunov, G. Hazel, J. Iyengar, M. Kuehlewind, “Low Extra Delay [18] D. Kundur, K. Ahsan, “Practical Internet Steganography: Data Background Transport (LEDBAT),” IETF Internet Draft, July 2011, Hiding in IP,” Proc. Texas Workshop on Security of Information URL: http://tools.ietf.org/html/draft-ietf-ledbat-congestion-07. Systems, College Station, Texas, 2003. [6] Zishuai Li, Xingming Sun, Baowei Wang, Xiaoliang Wang, “A [19] X. Luo, E. Chan, P. Zhou, R. Chang, “Robust Network Covert Steganography Scheme in P2P Network,” Proc. of International Communications Based on TCP and Enumerative Combinatorics,” Conference on Intelligent Information Hiding and Multimedia Signal IEEE Trans. Dependable Sec. Comput. 9(6): 890-902 (2012) Processing (IIH-MSP 2008), August 2008, pp. 20–24.
157